[braghettos]

Closes #28.

Summary

This ports krateoplatformops#76 (by @EdmondDantes21, merged in the old repo on 2026-09-07). It's the only commit from the old repo that never reached this one; the fix itself is theirs.

• authn's own certificate (authn-clientconfig) is renewed in the background (internal/certrenewal). It's issued at boot and re-issued at AUTHN_CRT_RENEWAL_THRESHOLD (default 0.66) of the granted lifetime. Before this, it was written once and expired in place, breaking every RESTAction call until the pod restarted.
• The granted window is recorded. Every clientconfig Secret is annotated with authn.krateo.io/certificate-not-{before,after}, and authn logs a warn when the signer grants under 90% of the request (OpenShift caps at 720h).
• Every login JWT is clamped to its certificate's real NotAfter (encode.tokenDuration), so a session can't outlive its credential. This now includes the serviceaccount strategy, which Smoke-check contract for a roll; /strategies answers application/json #76 predates.
• New knobs, defaulting to today's behaviour: AUTHN_SERVICE_CRT_EXPIRES_IN (8760h), AUTHN_CRT_RENEWAL_THRESHOLD (0.66), AUTHN_CRT_RENEWAL_ENABLED (true). They're in the chart's env and typed in values.schema.json; the schema rejects a threshold outside (0,1).
• No new RBAC.

Adaptation choices

• Layout: moved to go/authn/ with krateo-platformops module paths.
• RS256: encode.Extras keeps this repo's RS256 fields (JwtPrivateKey, JwtKeyID) and adds CertNotAfter. Smoke-check contract for a roll; /strategies answers application/json #76's test was moved from the old shared signing key to an RSA key.
• Dropped: Smoke-check contract for a roll; /strategies answers application/json #76's CI runner and Dockerfile changes. main already uses the org's reusable workflows and golang:1.25-trixie.
• Docs: Smoke-check contract for a roll; /strategies answers application/json #76's README section became docs/certificate-renewal.md, matching this repo's documentation standard. I also updated:
  • configuration.md (env table and flags)
  • behavior.md (JWT clamp in the response contract)
  • architecture.md (boot step 9)
  • gotchas.md (single-replica assumption; requested lifetime is a wish)
  • index.md, llms.txt, log.md
• Script: verify-cert-renewal.sh is now at go/authn/scripts/. Its header claimed --wait rewinds annotations, but the code collapses the threshold and restarts authn; the header now says that.

Test plan

• go build, go vet and go test ./... pass locally (12 packages, including certrenewal, encode, helpers/kube, config/storage).
• helm template renders the three knobs; the schema rejects AUTHN_CRT_RENEWAL_THRESHOLD=1.5.
• CI (CRD drift guard, checks, security).
• Not yet run in this repo: kind end-to-end with go/authn/scripts/verify-cert-renewal.sh --short 15m. Smoke-check contract for a roll; /strategies answers application/json #76 verified kind in the old repo.
• Capped-signer distributions (OpenShift, EKS, AKS, GKE, k3s, minikube) are still unverified, as Client certificates in *-clientconfig Secrets are never renewed #28 requires.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TLFnUe4HXFphxQNAfqFawZ

[braghettos]

End-to-end on kind with a capped signer: pass

I ran the branch image on kind v1.36 with kube-controller-manager --cluster-signing-duration=20m. That simulates OpenShift's non-configurable signing cap, the case #28 lists as unverified.

Check	Result
Granted window is read, not assumed	authn requested 8760h and the signer granted 25m. authn logged warn with requested/granted/renewAt.
Validity annotations	authn.krateo.io/certificate-not-{before,after} are present on authn-clientconfig and match the certificate.
Renewal fires before expiry	Re-issued at the 0.66 threshold: the first cert was valid 13:51:12 to 14:16:12, and the new one 14:02:45 to 14:27:45. The pod had 0 restarts.
Renewed cert accepted by the apiserver	kubectl auth whoami with the renewed cert returns authn / [authn …].
Login JWT clamped	/serviceaccount/login: with AUTHN_KUBECONFIG_CRT_EXPIRES_IN=24h, the JWT lifetime is 19m and its exp equals the certificate's NotAfter (14:16:40Z) to the second.

Recorded row: | kind (capped 20m) | requested 8760h | granted 25m | renewal ok | apiserver ok |

The run found two bugs in the verify script, both fixed on this branch:

• date parsed openssl's English month names in the current locale, so the script failed under non-English locales (it_IT). It now pins LC_ALL=C.
• Step 3 connected to the Secret's in-cluster server-url (kubernetes.default.svc), which doesn't resolve off-cluster. It now presents the certificate to the current context's apiserver. Sub-hour grants also print as minutes.